--- a/dom/base/DocGroup.cpp
+++ b/dom/base/DocGroup.cpp
@@ -9,34 +9,44 @@
 #include "mozilla/Telemetry.h"
 #include "nsIDocShell.h"
 #include "nsIEffectiveTLDService.h"
 #include "nsIURI.h"
 
 namespace mozilla {
 namespace dom {
 
-/* static */ void
+/* static */ nsresult
 DocGroup::GetKey(nsIPrincipal* aPrincipal, nsACString& aKey)
 {
   aKey.Truncate();
   nsCOMPtr<nsIURI> uri;
   nsresult rv = aPrincipal->GetURI(getter_AddRefs(uri));
+  if (NS_FAILED(rv)) {
+    return NS_OK;   // aKey is the empty string
+  }
+
   // GetBaseDomain works fine if |uri| is null, but it outputs a warning
   // which ends up cluttering the logs.
-  if (NS_SUCCEEDED(rv) && uri) {
-    nsCOMPtr<nsIEffectiveTLDService> tldService =
-      do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
-    if (tldService) {
-      rv = tldService->GetBaseDomain(uri, 0, aKey);
-      if (NS_FAILED(rv)) {
-        aKey.Truncate();
-      }
-    }
+  if (!uri) {
+    return NS_OK;   // aKey is the empty string
   }
+
+  nsCOMPtr<nsIEffectiveTLDService> tldService =
+    do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+  if (!tldService) {
+    return NS_ERROR_FAILURE;
+  }
+
+  rv = tldService->GetBaseDomain(uri, 0, aKey);
+  if (NS_FAILED(rv)) {
+    aKey.Truncate();
+  }
+
+  return NS_OK;   // aKey may be the empty string
 }
 
 void
 DocGroup::RemoveDocument(nsIDocument* aDocument)
 {
   MOZ_ASSERT(mDocuments.Contains(aDocument));
   mDocuments.RemoveElement(aDocument);
 }

--- a/dom/base/DocGroup.h
+++ b/dom/base/DocGroup.h
@@ -39,17 +39,22 @@ class TabGroup;
 class DocGroup final : public Dispatcher
 {
 public:
   typedef nsTArray<nsIDocument*>::iterator Iterator;
   friend class TabGroup;
 
   NS_DECL_THREADSAFE_ISUPPORTS
 
-  static void GetKey(nsIPrincipal* aPrincipal, nsACString& aString);
+  // Returns NS_ERROR_FAILURE and sets |aString| to an empty string if the TLD
+  // service isn't available. Returns NS_OK on success, but may still set
+  // |aString| may still be set to an empty string.
+  static MOZ_MUST_USE nsresult
+  GetKey(nsIPrincipal* aPrincipal, nsACString& aString);
+
   bool MatchesKey(const nsACString& aKey)
   {
     return aKey == mKey;
   }
   TabGroup* GetTabGroup()
   {
     return mTabGroup;
   }

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -2862,18 +2862,22 @@ nsDocument::SetPrincipal(nsIPrincipal *a
 
 mozilla::dom::DocGroup*
 nsIDocument::GetDocGroup() const
 {
 #ifdef DEBUG
   // Sanity check that we have an up-to-date and accurate docgroup
   if (mDocGroup) {
     nsAutoCString docGroupKey;
-    mozilla::dom::DocGroup::GetKey(NodePrincipal(), docGroupKey);
-    MOZ_ASSERT(mDocGroup->MatchesKey(docGroupKey));
+
+    // GetKey() can fail, e.g. after the TLD service has shut down.
+    nsresult rv = mozilla::dom::DocGroup::GetKey(NodePrincipal(), docGroupKey);
+    if (NS_SUCCEEDED(rv)) {
+      MOZ_ASSERT(mDocGroup->MatchesKey(docGroupKey));
+    }
     // XXX: Check that the TabGroup is correct as well!
   }
 #endif
 
   return mDocGroup;
 }
 
 nsresult
@@ -4372,19 +4376,22 @@ nsDocument::SetScopeObject(nsIGlobalObje
     nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aGlobal);
     if (window) {
       // We want to get the tabgroup unconditionally, such that we can make
       // certain that it is cached in the inner window early enough.
       mozilla::dom::TabGroup* tabgroup = window->TabGroup();
       // We should already have the principal, and now that we have been added to a
       // window, we should be able to join a DocGroup!
       nsAutoCString docGroupKey;
-      mozilla::dom::DocGroup::GetKey(NodePrincipal(), docGroupKey);
+      nsresult rv =
+        mozilla::dom::DocGroup::GetKey(NodePrincipal(), docGroupKey);
       if (mDocGroup) {
-        MOZ_RELEASE_ASSERT(mDocGroup->MatchesKey(docGroupKey));
+        if (NS_SUCCEEDED(rv)) {
+          MOZ_RELEASE_ASSERT(mDocGroup->MatchesKey(docGroupKey));
+        }
       } else {
         mDocGroup = tabgroup->AddDocument(docGroupKey, this);
         MOZ_ASSERT(mDocGroup);
       }
     }
   }
 }